win64_remote64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

win64_remote64.exe
Size

804KB
MD5

9613938952c5e2991063309982f2ae58
SHA1

aae4c44ec35960f3729142e0b64edac445d29227
SHA256

bf229ad6affcd486910c5654e777dc586f7e806d14b1d6613e03dde26359f2cf
SHA512

9bc1a6b96d577bf7d5b9157ebf64f281326440a2d9dd678205e446b6af81db9bcfb96f6c86e30c37bef683544743953d8ee46f89a3fbaf9f18cc94579c2ad8a5
SSDEEP

24576:RDe8PcYcOoDekAMNHFZ5AXxu8PcXroThr0:JvXvMHFZmXoa+oT

Score

1^/10

Malware Config

Signatures

Files

win64_remote64.exe
.exe windows x64

939a01638c72ee05c6ea980f0c54c465

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ole32

CoTaskMemFree
StringFromCLSID
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantInit
SysFreeString

ws2_32

WSASetLastError
getaddrinfo
WSAStartup
getservbyname
getservbyport
WSACleanup
WSAGetLastError
freeaddrinfo
socket
shutdown
setsockopt
sendto
select
recvfrom
ntohs
listen
inet_addr
htons
htonl
getsockname
getpeername
connect
closesocket
bind
accept
inet_ntoa
gethostbyaddr
gethostbyname

crypt32

CertGetCertificateChain
CertGetNameStringA
CertVerifyTimeValidity
CertAddEncodedCertificateToStore
CertFreeCertificateContext
CertFreeCertificateChain

secur32

DecryptMessage
EncryptMessage
FreeContextBuffer
QueryCredentialsAttributesA
QueryContextAttributesA
ApplyControlToken
DeleteSecurityContext
InitializeSecurityContextA
AcquireCredentialsHandleA

user32

PostThreadMessageA

kernel32

FlushFileBuffers
HeapFree
HeapAlloc
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetCommandLineW
GetTimeZoneInformation
MoveFileExW
DeleteFileW
FindNextFileW
FindFirstFileExW
GetConsoleOutputCP
WriteFile
ReadConsoleW
GetConsoleMode
SetEndOfFile
FileTimeToSystemTime
HeapReAlloc
SetStdHandle
GetFileSizeEx
GetOEMCP
FreeEnvironmentStringsW
GetCommandLineA
GetProcessHeap
SystemTimeToTzSpecificLocalTime
GetFileType
CreateDirectoryW
GetCurrentDirectoryW
SetEnvironmentVariableW
GetDriveTypeW
SetConsoleCtrlHandler
GetModuleHandleExW
GetStringTypeW
WriteConsoleW
FindClose
Sleep
FreeLibrary
GetProcAddress
ReadFile
SetFilePointerEx
CloseHandle
LoadLibraryA
GetModuleHandleA
CreateFileW
SearchPathA
LocalFree
FlushInstructionCache
VirtualProtectEx
VirtualQueryEx
GetCurrentProcess
TerminateProcess
GetThreadSelectorEntry
GetLastError
SetLastError
ReadProcessMemory
WriteProcessMemory
GetThreadContext
SetThreadContext
SuspendThread
ResumeThread
WaitForDebugEvent
ContinueDebugEvent
DebugActiveProcess
SetEvent
WaitForSingleObject
GetSystemInfo
CreateEventA
GetLogicalDriveStringsW
GetSystemDirectoryA
GetSystemWow64DirectoryA
GetCurrentDirectoryA
QueryDosDeviceW
OpenProcess
GetVersionExA
GetCurrentProcessId
FormatMessageA
ExitProcess
IsDebuggerPresent
HeapSize
GetSystemTimeAsFileTime
FormatMessageW
QueryPerformanceCounter
QueryPerformanceFrequency
GetExitCodeProcess
GetEnvironmentStringsW
CreateThread
GetCurrentThreadId
TerminateThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
GetStdHandle
CreateSemaphoreA
CreateProcessW
SearchPathW
GetFullPathNameW
GetModuleFileNameW
GetFileAttributesW
MultiByteToWideChar
IsValidCodePage
GetACP
GetCPInfo
IsDBCSLeadByteEx
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
GetModuleHandleW
InitializeSListHead
LoadLibraryExW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EncodePointer
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree

Sections

.text
Size: 550KB - Virtual size: 549KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 204KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

939a01638c72ee05c6ea980f0c54c465

Headers

DLL Characteristics

File Characteristics

Imports

ole32

oleaut32

ws2_32

crypt32

secur32

user32

kernel32

Sections

.text Size: 550KB - Virtual size: 549KB

.rdata Size: 204KB - Virtual size: 203KB

.data Size: 16KB - Virtual size: 29KB

.pdata Size: 26KB - Virtual size: 26KB

_RDATA Size: 512B - Virtual size: 244B

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 550KB - Virtual size: 549KB

.rdata
Size: 204KB - Virtual size: 203KB

.data
Size: 16KB - Virtual size: 29KB

.pdata
Size: 26KB - Virtual size: 26KB

_RDATA
Size: 512B - Virtual size: 244B

.reloc
Size: 6KB - Virtual size: 5KB